CoinDCX confirmed on October 25 a loss of about 15.99 million USDT from retired deposit wallets, days after its CEO had publicly called early breach reports a false alarm. The funds left around 40 TRON addresses that the exchange says were generated in January 2025 and compromised in a July 2025 incident it claims its treasury already covered. The company says it will absorb the loss. The on-chain investigators say the timeline does not close.
The mechanism is operational, not an active break-in. An automated sweeping service that was supposed to move user deposits from the retired addresses into secure wallets failed for a period, and the funds piled up until they were drained. CoinDCX says it noticed the failure on the morning of October 22 and that current wallets, trading, and customer balances are unaffected, with affected deposits credited and customer assets held in segregated cold wallets. The 16 million dollar loss is a real number, but the framing that follows it is where the damage compounds.
The disputed timeline is the real story. On-chain watchers reported that at least one of the flagged deposit addresses was still used by a liquidity provider for months after the July 2025 incident and had swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026. Tether blacklisted some downstream wallets and froze roughly 2.2 million USDT, a fraction of the outflow. For a custody product, the question is no longer whether the loss was absorbed. It is whether the address that was supposed to be dead was still live on the hot path, and who was supposed to catch that before the sweep failed.
Image source: i.ibb.co